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Amended claims follow: 

1 . (Currently Amended) A computer program product for controlling a computer, 
said computer program product comprising: 

(i) scan request receiving logic operable to receive a request to perform an on- 
access mahvare scan upon a computer file to which access is to be made; 

(ii) scan dividing logic operable to divide said on-access mahvare scan into a 
plurality of tasks; 

(iii) task issuing logic operable to issue said plurality of tasks to be performed by 
a plurality of different computers; and 

(iv) result collating logic operable to collate a plurality of task results 
corresponding to said plurality of tasks and received from said plurality of different 
computers to form a scan result corresponding to said on-access mahvare scan. 

2. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said scan dividing logic further divides said computer file into a plurality of 
component computer files to be separately scanned as said plurality of tasks, 

3. (Currently Amended) A computer program product as claimed in claim 2, 
wherein said computer file contains one or more embedded computer files which are 
further divided out as component computer files. 

4. (Original) A computer program product as claimed in claim 3, wherein said 



computer file is one of the following computer file types: OLE2, ZIP, CAB, ARJ, RAR, 
ACE, JAR, ARC, LHA, LZH, ICE and Stufflt. 



wherein said scan dividing logic further divides said on-acce$$ malware scan into a 
plurality of on-access malware scans for identifying different properties of said computer 



5. 



(Currently Amended) A computer program product as claimed in claim 1, 
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file 5 said plurality of on-access malware scans being separately performed as said 
plurality of tasks. 

6. (Cunently Amended) A computer program product as claimed in claim 5, 
wherein said plurality of tasks each seek to further i dentify different portions of one of a 
cryptographic analysis and an emulation analysis. 

7. (Original) A computer program product as claimed in claim 1 , wherein said on- 
access malware scan of said computer file seeks to identify one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) an e-mail containing banned content. 

8. (Currently Amended) A computer program product as claimed in claim 1, 
wherein one or more of said tasks are tine rfurther d ivided into sub-tasks. 

9. (Currently Amended) A computer program product as claimed in claim 1 3 
wherein a task is further selected to be issued to a different computer in dependence upon 
one or more of: 

(i) a measure of available processing resources at said different computer; 

(ii) a measure of communication channel bandwidth to said different computer; 

(iii) a measure of task complexity of said task to be issued; and 

(iv) a measure of processor utilization of said different computer. 

1 0. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said scan dividing logic does not further divide said on-access malware scan if 
said on-access malware scan is detected as having a complexity below a predetermined 
threshold level. 
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1 1 . (Currently Amended) A computer program product as claimed in claim 10, 
wherein said complexity is further determined as a function of one or more of: 

(i) a file type of said computer file; 

(ii) whether said computer file contains any embedded computer files; 

(iii) a level of nesting of embedded files within said computer file; 

(iv) an initial scanning attempt of said computer file taking longer than a 
predetermined time; and 

(v) processor utilization of a computer initiating said request 

12. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said result collating logi c farther terminates any outstanding tasks if a task result 
is received indicating detection of malware within said computer file. 

1 3 . (Currently Amended) A computer program product for controlling a computer, 
said computer program product comprising; 

(i) task receiving logic operable to receive a request to perform a malware 
scanning task that is part of an on-access malware scan of a computer file requested by 
another computer; 

(ii) scanning logic operable to perform said malware scanning task; and 

(iii) result returning logic operable to return a result of said malware scanning 

task; 

wherein said malware scanning task is one of a plurality of malware scanning 
tasks that are each part of said on-access malware scan; 

wherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan[[ ]]. 

14. (Currently Amended) A computer program product as claimed in claim 13, 
wherein said computer file is further divided into a plurality of component computer files 
to be separately scanned as separate malware scanning tasks. 
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15. (Currently Amended) A computer program product as claimed in claim 13, 
wherein said on-access malware scan of said computer file is further divided into said 
plurality of on-access malware scanning tasks for identifying different properties of said 
computer file, said plurality of on-access malware scanning tasks being separately 
performed. 

1 6. (Currently Amended) A method of performing an on-access malware scan of a 
computer file, said method comprising the steps of: 

(i) receiving a request to perform an on-access malware scan upon a computer file 
to which access is to he made; 

(ii) dividing said on-access malware scan into a plurality of tasks; 

(iii) issuing said plurality of tasks to be performed by a plurality of different 
computers; and 

(iv) collating a plurality of task results corresponding to said plurality of tasks and 
received from said plurality of different computers to form a scan result corresponding to 
said on-access malware scan. 

17. (Currently Amended) A method as claimed in claim 16, wherein said computer 
file is further divided into a plurality of component computer files to be separately 
scanned as said plurality of tasks, 

1 8. (Currently Amended) A method as claimed in claim 1 7, wherein said computer 
file contains one or more embedded computer files which are further divided out as 
component computer files. 

19. (Original) A method as claimed in claim 1 8, wherein said computer file is one of 
the following computer file types: OLE2, ZIP, CAB, ARJ, RAR, ACE, JAR, ARC, LHA, 
LZH, ICE and Stufflt. 

20. (Currently Amended) A method as claimed in claim 16, wherein said on-access 
malware scan is further d ivided into a plurality of on-access malware scans for 
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identifying different properties of said computer file, said plurality of on-access malware 
scans being separately performed as said plurality of tasks. 

21 . (Currently Amended) A method as claimed in claim 20, wherein said plurality of 
tasks each seek to further identify different portions of one of a cryptographic analysis 
and an emulation analysis. 

22. (Currently Amended) A method as claimed in claim 16, wherein said on-access 
malware scan of said computer file further seeks to identify one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) an e-mail containing banned content. 

23. (Original) A method as claimed in claim 1 6, wherein one or more of said tasks are 
further divided into sub-tasks. 

24. (Currently Amended) A method as claimed in claim 16, wherein a task is further 
selected to be issued to a different computer in dependence upon one or more of: 

(i) a measure of available processing resources at said different computer; 

(ii) a measure of communication channel bandwidth to said different computer; 

(iii) a measure of task complexity of said task to be issued; and 

(iv) a measure of processor utilization of said different computer. 

25. (Currently Amended) A method as claimed in claim 1 6, wherein said on-access 
malware scan is not further divided if said on-access malware scan is detected as having a 
complexity below a predetermined threshold level. 

26. (Currently Amended) A method as claimed in claim 25, wherein said complexity 
is further determined as a function of one or more of: 
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(i) a file type of said computer file; 

(ii) whether said computer file contains any embedded computer files; 

(iii) a level of nesting of embedded files within said computer file; 

(iv) an initial scanning attempt of said computer file taking longer than a 
predetermined time; and 

(v) processor utilization of a computer initiating said request. 

27, (Currently Amended) A method as claimed in claim 1 6, wherein any outstanding 
tasks ar e further terminated if a task result is received indicating detection of malware 
within said computer file. 

28, (Previously Presented) A method of on-access malware scanning, said method 
comprising the steps of: 

(i) receiving a request to perform a malware scanning task that is part of an on- 
access malware scan of a computer file requested by another computer; 

(ii) performing said malware scanning task; and 

(iii) returning a result of said malware scanning task; 

wherein said malware scanning task is one of a plurality of malware scanning 
tasks that are each part of said on-access malware scan; 

wherein a plurality Of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan. 

29, (Currently Amended) A method as claimed in claim 28, wherein said computer 
file is further divided into a plurality of component computer files to be separately 
scanned as separate malware scanning tasks. 

30, (Currently Amended) A method claimed in claim 28, wherein said on-access 
malware scan of said computer file is further divided into said plurality of on-access 
malware scanning tasks for identifying different properties of said computer file, said 
plurality of on-access malware scanning tasks being separately performed. 



PAGE 11/13 * RCVD AT 10/30/2006 4:18:47 PNI [Eastern Standard Time) < SVR:USPTO-EFXRF-6/38 * DNIS:2738300 ■ CSID:4089714660 ' DURATION (mm-ss):02-06 



OCT. 30. 2006 1:31PM ZILKA-KOTAB, PC 



NO. 4557 P. 12 



-9- 



3 1 . (Currently Amended) Apparatus for performing an on-access malware scan of a 
computer file, said apparatus comprising: 

(i) a scan request receiver operable to receive a request to perform an on-access 
malware scan upon a computer file to which access is to be made; 

(ii) a scan divider operable to divide said on-access malware scan into a plurality 
of tasks; 

(iii) a task issuer operable to issue said plurality of tasks to be performed by a 
plurality of different computers; and 

(iv) a result collator operable to collate a plurality of task results corresponding to 
said plurality of tasks and received from said plurality of different computers to form a 
scan result corresponding to said on-access malware scan, 

32. (Currently Amended) Apparatus as claimed in claim 3 1 > wherein said scan divider 
further divides said computer file into a plurality of component computer files to be 
separately scanned as said plurality of tasks. 

33. (Currently Amended) Apparatus as claimed in claim 32, wherein said computer 
file contains one or more embedded computer files which are further_divided out as 
component computer files. 

34. (Original) Apparatus as claimed in claim 33, wherein said computer file is one of 
the following computer file types: OLE2, ZIP, CAB, ARJ, RAR, ACE, JAR, ARC, LHA, 
LZH, ICE and Stufflt. 

35. (Currently Amended) Apparatus as claimed in claim 31, wherein said scan divider 
further divides said on-access malware scan into a plurality of on-access malware scans 
for identifying different properties of said computer file, said plurality of on-access 
malware scans being separately performed as said plurality of tasks. 

36. (Currently Amended) Apparatus as claimed in claim 35, wherein said plurality of 
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